Due to illegal inputs, various types of TCP stacks respond in a different manner. Some IDSs
do not take into account the TCP protocol’s urgency feature, which could allow testers to
evade the IDS.

Penetration tester needs to try different combinations of TCP flags (e.g. none, SYN/FIN,
SYN/RST, SYN/FIN/ACK, SYN/RST/ACK, and All Flags) to test the IDS.

Which of the following TCP flag combinations combines the problem of initiation, midstream,
and termination flags with the PSH and URG?

A.
SYN/RST/ACK

B.
SYN/FIN/ACK

C.
SYN/FIN

D.
All Flags

Explanation:

Reference:
http://books.google.com.pk/books?id=tUCumJot0ocC&pg=PA63&lpg=PA63&dq=TCP+flag+
combinations+combines+the+problem+of+initiation,+midstream,+and+termination+flags+wit
h+the+PSH+and+URG&source=bl&ots=mIGSXBIi15&sig=WMnXlEChVSU4RhK65W_V3tzN
jns&hl=en&sa=X&ei=H7AfVJCtLaufygO1v4DQDg&ved=0CBsQ6AEwAA#v=onepage&q=TC
P%20flag%20combinations%20combines%20the%20problem%20of%20initiation%2C%20m
idstream%2C%20and%20termination%20flags%20with%20the%20PSH%20and%20URG&f
=false(see the highlighted sentence in Table 3-1 at the end of the page)